Closes #55. Second issue of S5 — Live capture (builds on #54).

Summary

src/capture/decode.zig turns one WebSocket text frame into a canonical engine
Event. The key difference from the offline parser: live direction is known
from the socket (which peer sent the frame), so it's set explicitly and
unknown never arises — an accuracy win over the offline two-pass inference. The
timestamp is the wall-clock receipt time (live frames carry no message-level
timestamp of their own).

Everything else mirrors the offline pipeline exactly — the same schema gate
(parser.validateRawMessage) and the same normalizer field extraction — so a
recorded frame re-parses to the same event offline. That portability is what
the recorder (#56) and the shared conformance contract rest on.

Parity anchor

A test proves the full round-trip: decodeEvent → JSONL object record
({timestamp, direction, message}) → offline parseTrace → identical event
(id, message_id, type, action, direction, timestamp, payload). Recording detail
surfaced here and noted for #56: received_ms is epoch milliseconds, and
real wall-clock is always ≥ 10¹², so it survives the offline normalizer's
seconds/ms threshold unchanged.

Reuse, not duplication

Exposes two pure engine helpers the decoder shares with the offline path:
parser.validateRawMessage and normalizer.messageIdOf (both fn → pub fn).
No logic is re-implemented.

Hardening (untrusted input)

• Per-message byte cap (10 MiB, the engine's untrusted ceiling), checked
  before parsing — live and offline reject the same oversized messages.
• Malformed frames (InvalidJson / NotOcppJMessage) return a typed error the
  caller records/skips, never aborting the session.

Tests

6 new (144 total, up from 138): Call/CallResult/CallError decode with
socket-direction, direction-not-inferred, every rejection path, oversize, and the
offline-parity round-trip.

Verification

• native test -Dplatform=null → 144/144.
• native build (ReleaseFast) → clean.
• zig fmt --check clean.